ZeroFox Intelligence Flash Report - Newly Identified “UBUD” Ransomware Product For Sale

Product Serial: F-2023-11-22b

TLP:CLEAR

In this flash report, ZeroFox researchers report on the announcement of the sale of a newly developed ransomware product dubbed “UBUD” on the Dark Web marketplace RAMP.

Standing Intelligence Requirements

Deep Dark Web and Criminal Underground DDW

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here

Key Findings

On November 17, 2023, positively trending threat actor “IsEmptyOrNull” announced the sale of a newly developed ransomware product dubbed “UBUD” on the Dark Web marketplace RAMP.
Rather than a typical ransomware-as-a-service (RaaS) offering, UBUD is designed for solitary use and is a highly customizable product, with each payload build likely adapted for each deployment, making the detection and removal of the malicious code more difficult.
Threat actors have demanded a very high price to purchase UBUD–2.5 BTC, or more than USD 90,000–more likely than not indicating that the ransomware has capabilities beyond those stated in the public description.
UBUD’s appearance illustrates a trend in which entrepreneur-deployed ransomware is becoming more prolific and available. While most likely to be deployed in a limited number of targeted attacks, UBUD reflects the general trend whereby less-competent actors are increasingly able to deploy effective ransomware and digital extortion products as long as they have sufficient funds.